saymrwulf/cryptography
1
0
Fork 0
mirror of https://github.com/saymrwulf/cryptography.git synced 2026-05-14 20:37:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

more warnings and context around RSA online decryption (#7699)

Browse source
This commit is contained in:
Paul Kehrer 2022-10-12 11:14:56 -04:00 committed by GitHub
parent 7a22e6262b
commit 34412de1b2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 14 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
docs/hazmat/primitives/asymmetric/rsa.rst
View file

@ -555,6 +555,11 @@ Key interfaces
.. versionadded:: 0.4
.. warning::
Our implementation of PKCS1 v1.5 decryption is not constant time. See
:doc:`/limitations` for details.
Decrypt data that was encrypted with the public key.
:param bytes ciphertext: The ciphertext to decrypt.

16
docs/limitations.rst
View file

@ -24,21 +24,23 @@ RSA PKCS1 v1.5 constant time decryption
---------------------------------------
RSA decryption has several different modes, one of which is PKCS1 v1.5. When
used in online contexts, a secure protocol implementation requires that peers
not be able to tell whether RSA PKCS1 v1.5 decryption failed or succeeded,
even by timing variability.
used in **online contexts**, a secure protocol implementation requires that
peers not be able to tell whether RSA PKCS1 v1.5 decryption failed or
succeeded, even by timing variability.
``cryptography`` does not provide an API that makes this possible, due to the
fact that RSA decryption raises an exception on failure, which takes a
different amount of time than returning a value in the success case.
For this reason, at present, we recommend not implementing online protocols
Fixing this would require a new API in ``cryptography``, but OpenSSL does
not expose an API for straightforwardly implementing this while reusing
its own constant-time logic. See `issue 6167`_ for more information.
For this reason we recommend not implementing online protocols
that use RSA PKCS1 v1.5 decryption with ``cryptography`` -- independent of this
limitation, such protocols generally have poor security properties due to their
lack of forward security.
If a constant time RSA PKCS1 v1.5 decryption API is truly required, you should
contribute one to ``cryptography``.
.. _`Memory wiping`: https://devblogs.microsoft.com/oldnewthing/?p=4223
.. _`CERT secure coding guidelines`: https://wiki.sei.cmu.edu/confluence/display/c/MEM03-C.+Clear+sensitive+information+stored+in+reusable+resources
.. _`issue 6167`: https://github.com/pyca/cryptography/issues/6167#issuecomment-1276151799